[GEODE-10619] Remediation of CVE-2026-59296 (#8044)

* micrometer update

* jspecify for micrometer

Author: JinwooHwang

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -195,7 +195,7 @@
       <dependency>
         <groupId>io.micrometer</groupId>
         <artifactId>micrometer-core</artifactId>
-        <version>1.15.12</version>
+        <version>1.16.7</version>
       </dependency>
       <dependency>
         <groupId>io.swagger.core.v3</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -48,7 +48,7 @@ class DependencyConstraints {
     deps.put("jgroups.version", "3.6.20.Final")
     deps.put("log4j.version", "2.25.5")
     deps.put("log4j-slf4j2-impl.version", "2.23.1")
-    deps.put("micrometer.version", "1.15.12")
+    deps.put("micrometer.version", "1.16.7")
     deps.put("shiro.version", "3.0.0")
     // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version
     deps.put("bouncycastle.version", "1.85")

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -1014,6 +1014,7 @@ lib/jna-5.11.0.jar
 lib/jna-platform-5.11.0.jar
 lib/joda-time-2.12.7.jar
 lib/jopt-simple-5.0.4.jar
+lib/jspecify-1.0.1.jar
 lib/jul-to-slf4j-2.0.17.jar
 lib/log4j-api-2.25.5.jar
 lib/log4j-core-2.25.5.jar
@@ -1025,9 +1026,9 @@ lib/lucene-analysis-phonetic-9.12.3.jar
 lib/lucene-core-9.12.3.jar
 lib/lucene-queries-9.12.3.jar
 lib/lucene-queryparser-9.12.3.jar
-lib/micrometer-commons-1.15.12.jar
-lib/micrometer-core-1.15.12.jar
-lib/micrometer-observation-1.15.12.jar
+lib/micrometer-commons-1.16.7.jar
+lib/micrometer-core-1.16.7.jar
+lib/micrometer-observation-1.16.7.jar
 lib/mx4j-3.0.2.jar
 lib/mx4j-remote-3.0.2.jar
 lib/mx4j-tools-3.0.1.jar

geode-assembly/src/integrationTest/resources/expected_jars.txt

@@ -80,6 +80,7 @@ joda-time
 jopt-simple
 json-path
 json-smart
+jspecify
 jul-to-slf4j
 lang-tag
 log4j-api

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -75,7 +75,7 @@ commons-digester-2.1.jar
 commons-io-2.19.0.jar
 commons-logging-1.3.5.jar
 classgraph-4.8.147.jar
-micrometer-core-1.15.12.jar
+micrometer-core-1.16.7.jar
 HdrHistogram-2.2.2.jar
 fastutil-8.5.8.jar
 jakarta.resource-api-2.1.0.jar
@@ -117,9 +117,10 @@ jetty-jndi-12.0.37.jar
 jetty-util-12.0.37.jar
 slf4j-api-2.0.18.jar
 jackson-annotations-2.21.jar
-micrometer-observation-1.15.12.jar
+micrometer-observation-1.16.7.jar
 spring-jcl-6.1.21.jar
-micrometer-commons-1.15.12.jar
+micrometer-commons-1.16.7.jar
+jspecify-1.0.1.jar
 LatencyUtils-2.0.3.jar
 snakeyaml-2.5.jar
 reactor-core-3.6.10.jar

geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java

@@ -39,13 +39,10 @@
 import io.micrometer.core.instrument.noop.NoopLongTaskTimer;
 import io.micrometer.core.instrument.noop.NoopMeter;
 import io.micrometer.core.instrument.noop.NoopTimer;
-import io.micrometer.core.lang.NonNullApi;
-import io.micrometer.core.lang.Nullable;
 
 import org.apache.geode.annotations.Immutable;
 import org.apache.geode.annotations.VisibleForTesting;
 
-@NonNullApi
 public class NoopMeterRegistry extends MeterRegistry {
 
   @Immutable
@@ -71,7 +68,7 @@ private NoopMeterRegistry(Clock clock) {
   }
 
   @Override
-  protected <T> Gauge newGauge(Meter.Id id, @Nullable T obj, ToDoubleFunction<T> valueFunction) {
+  protected <T> Gauge newGauge(Meter.Id id, T obj, ToDoubleFunction<T> valueFunction) {
     return new NoopGauge(id);
   }
 

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -46,7 +46,7 @@ spring-shell-standard-commands-3.3.3.jar
 spring-shell-standard-3.3.3.jar
 spring-shell-core-3.3.3.jar
 commons-io-2.19.0.jar
-micrometer-core-1.15.12.jar
+micrometer-core-1.16.7.jar
 jakarta.resource-api-2.1.0.jar
 jetty-ee10-annotations-12.0.37.jar
 spring-boot-starter-validation-3.3.13.jar
@@ -117,8 +117,9 @@ jetty-util-12.0.37.jar
 spring-boot-starter-logging-3.3.13.jar
 jul-to-slf4j-2.0.17.jar
 slf4j-api-2.0.18.jar
-micrometer-observation-1.15.12.jar
-micrometer-commons-1.15.12.jar
+micrometer-observation-1.16.7.jar
+micrometer-commons-1.16.7.jar
+jspecify-1.0.1.jar
 LatencyUtils-2.0.3.jar
 snakeyaml-2.5.jar
 spring-jcl-6.1.21.jar